@phnx-labs/agents-cli 1.22.14 → 1.22.16

package/dist/commands/projects.js

@@ -20,16 +20,15 @@ import { machineId } from '../lib/machine-id.js';
 import { getActiveSessions } from '../lib/session/active.js';
 import { gatherRemoteActive } from '../lib/session/remote-active.js';
 import { gatherRemoteAgentsJson } from '../lib/remote-agents-json.js';
-import { factoryProjectsPath } from '../lib/auto-dispatch.js';
 import { formatFleetWorkspaces, parseRemoteProbe, probeProjectWorkspaces, workspaceTargetsForDef, workspaceWarnings, } from '../lib/project-probe.js';
-import { listProjectDefs, loadProjectDef, writeProjectDef, removeProjectDef, projectDefPath, isSafeProjectName, } from '../lib/projects.js';
+import { listProjectDefs, loadProjectDef, writeProjectDef, removeProjectDef, projectDefPath, isSafeProjectName, validateProjectDef, } from '../lib/projects.js';
 import { rollupSessionsByProject, withDefaultMachine, isDeadStatus, liveDeadSplit, enrichProjectSignals, formatProjectMembersByHost, formatProjectWarnings, } from '../lib/project-status.js';
 import { fetchLinearProjectCounts } from '../lib/linear-project-counts.js';
 import { listLinearProjects, pickLinearProject } from '../lib/linear-projects.js';
 import { checkRepoSlug } from '../lib/project-doctor.js';
 import { formatFocusAreas, readFocusAreas } from '../lib/project-focus.js';
 import { formatVerdict, scheduleVerdict } from '../lib/project-schedule.js';
-import { buildFactoryImportCandidates, buildLinearImportCandidates, validateImportOpts, } from '../lib/project-import.js';
+import { buildLinearImportCandidates, validateImportOpts, } from '../lib/project-import.js';
 /** Recursion guard: a peer answering a probe fan-out never re-fans-out itself. */
 export const PROJECTS_NO_FANOUT_ENV = 'AGENTS_PROJECTS_LOCAL';
 /** Max peers named in the skipped note before the rest collapse to `+N`. */
@@ -73,11 +72,8 @@ function parseGoalFlag(raw) {
  *
  * `stderr: 'ignore'` is load-bearing, not tidiness. A checkout with no origin
  * makes git print `error: No such remote 'origin'` on ITS stderr, which is the
- * terminal's — the catch below never sees it. That was invisible while this was
- * called once from `add` inside a real repo, and became noise the moment
- * `import --from-factory` started calling it per row: importing 12 registry
- * rows printed two raw git errors between the progress lines. Absence of a
- * remote is an expected answer here (`undefined`), not something to report.
+ * terminal's — the catch below never sees it. Absence of a remote is an
+ * expected answer here (`undefined`), not something to report.
  */
 export function originSlug(cwd) {
     try {
@@ -92,38 +88,6 @@ export function originSlug(cwd) {
         return undefined;
     }
 }
-/**
- * Read the Factory registry off disk and plan its import. Every read failure is
- * fatal and named — an unreadable or malformed registry must not read as "0
- * projects to import".
- */
-function runFactoryImport(existing, opts) {
-    const src = factoryProjectsPath();
-    let rawText;
-    try {
-        rawText = fs.readFileSync(src, 'utf8');
-    }
-    catch {
-        console.error(chalk.red(`No Factory registry at ${src}`));
-        process.exit(1);
-    }
-    let parsed;
-    try {
-        parsed = JSON.parse(rawText);
-    }
-    catch {
-        console.error(chalk.red(`Factory registry at ${src} is not valid JSON`));
-        process.exit(1);
-    }
-    const rows = Array.isArray(parsed)
-        ? parsed
-        : Array.isArray(parsed?.projects)
-            ? parsed.projects
-            : [];
-    // The checkout's real `origin` overrides the registry's path-derived slug —
-    // see buildFactoryImportCandidates for why the path guess is not trustworthy.
-    return buildFactoryImportCandidates(rows, existing, opts, (root) => originSlug(expandLocalHome(root)));
-}
 /**
  * List the workspace's Linear projects and plan their import, binding each to a
  * local checkout under the configured projects root when the names match
@@ -442,7 +406,11 @@ export function registerProjectsCommands(program) {
         examples: `
       agents projects import --from-linear  # the projects you actually track
       agents projects add rush --repo phnx-labs/rush --path apps/web
-      agents projects list
+      agents projects list                 # definitions only (no session scan)
+      agents projects list --with-agents   # opt-in local active counts
+      agents projects list --json          # machine-readable defs (Factory uses this)
+      echo '{...}' | agents projects save --json  # create/update one def from stdin
+      agents projects rm rush --json       # machine-readable delete
       agents projects status              # every project, across the whole fleet
       agents projects status rush         # one project (same body as view/show)
       agents projects view rush           # alias of status <name>
@@ -452,31 +420,34 @@ export function registerProjectsCommands(program) {
     `,
         notes: `
       Definitions are hand-editable YAML in ~/.agents/projects/ and sync across
-      machines with 'agents push/pull'.
-
-      'import --from-factory' reads Factory's auto-detected registry, which
-      guesses from checkouts on disk — it imports only 'high' confidence rows by
-      default. Widen with --min-confidence medium or --all, and drop a bad guess
-      with 'agents projects rm <name>'.
+      machines with 'agents push/pull'. Factory reads and writes only through
+      these commands — never ~/.agents/factory/projects.json.
     `,
     });
     // ---- list ----
     projects
         .command('list')
-        .description('List defined projects with their root, repo, and live agent count.')
+        .description('List defined projects (definitions only by default; no session scan).')
         .option('--json', 'Machine-readable output')
+        .option('--with-agents', 'Include local active agent counts (opt-in; never SSH)')
         .action(async (opts) => {
         const defs = listProjectDefs();
+        // Definitions-only by default: zero session scan / SSH. --with-agents is
+        // an explicit opt-in for local active counts only (getActiveSessions is
+        // local; it never fans out).
+        const roll = opts.withAgents
+            ? rollupSessionsByProject(defs, await getActiveSessions())
+            : undefined;
         if (opts.json) {
-            const roll = rollupSessionsByProject(defs, await getActiveSessions());
-            console.log(JSON.stringify(defs.map((d) => ({ ...d, agents: roll.get(d.name)?.agents ?? 0 })), null, 2));
+            console.log(JSON.stringify(opts.withAgents
+                ? defs.map((d) => ({ ...d, agents: roll.get(d.name)?.agents ?? 0 }))
+                : defs, null, 2));
             return;
         }
         if (!defs.length) {
             console.log(chalk.gray('No projects defined. Add one: agents projects add <name>'));
             return;
         }
-        const roll = rollupSessionsByProject(defs, await getActiveSessions());
         const rows = defs.map((d) => ({
             name: d.name,
             path: truncate(d.root ?? d.defaultPath ?? '', LIST_PATH_MAX),
@@ -484,9 +455,9 @@ export function registerProjectsCommands(program) {
         }));
         const w = computeProjectListWidths(rows);
         for (const [i, d] of defs.entries()) {
-            const agents = roll.get(d.name)?.agents ?? 0;
             const row = rows[i];
-            console.log(`  ${chalk.bold(row.name.padEnd(w.name))} ${chalk.dim(row.path.padEnd(w.path))} ${chalk.cyan(row.repo.padEnd(w.repo))} ${agents} agents`);
+            const agentsSuffix = opts.withAgents && roll ? ` ${roll.get(d.name)?.agents ?? 0} agents` : '';
+            console.log(`  ${chalk.bold(row.name.padEnd(w.name))} ${chalk.dim(row.path.padEnd(w.path))} ${chalk.cyan(row.repo.padEnd(w.repo))}${agentsSuffix}`);
         }
     });
     // ---- add ----
@@ -732,11 +703,8 @@ export function registerProjectsCommands(program) {
     // ---- import ----
     projects
         .command('import')
-        .description('Import project definitions from Linear (preferred) or the Factory auto-detection registry.')
-        .option('--from-linear', 'Import the workspace\'s Linear projects (via the `linear` CLI)')
-        .option('--from-factory', 'Import the Factory registry (~/.agents/factory/projects.json)')
-        .option('--min-confidence <level>', '--from-factory only: lowest detection confidence to import — low|medium|high (default: high)')
-        .option('--all', '--from-factory only: import every row regardless of confidence')
+        .description('Import project definitions from Linear (via the `linear` CLI).')
+        .option('--from-linear', 'Import the workspace\'s Linear projects')
         .option('--force', 'Overwrite existing definitions')
         .action((raw) => {
         let opts;
@@ -748,7 +716,7 @@ export function registerProjectsCommands(program) {
             process.exit(1);
         }
         const existing = new Map(listProjectDefs().map((d) => [d.name, d]));
-        const result = opts.source === 'linear' ? runLinearImport(existing, opts) : runFactoryImport(existing, opts);
+        const result = runLinearImport(existing, opts);
         for (const def of result.defs)
             writeProjectDef(def);
         const n = result.defs.length;
@@ -756,9 +724,6 @@ export function registerProjectsCommands(program) {
         console.log(chalk.green(`Imported ${n} project${n === 1 ? '' : 's'}${s ? chalk.gray(` (${s} skipped)`) : ''}`));
         for (const skip of result.skipped)
             console.log(chalk.gray(`  skip ${skip.name}: ${skip.reason}`));
-        if (opts.source === 'factory' && s > 0 && opts.minConfidence === 'high') {
-            console.log(chalk.gray('  (widen with --min-confidence medium or --all)'));
-        }
     });
     // ---- set ----
     projects
@@ -883,17 +848,79 @@ export function registerProjectsCommands(program) {
         writeProjectDef(def);
         console.log(chalk.green(`${def.name} → Linear project "${p.name}" (${p.id})${p.url ? ` ${p.url}` : ''}`));
     });
+    // ---- save ----
+    projects
+        .command('save')
+        .description('Create or update one project from a complete ProjectDef JSON object on stdin.')
+        .option('--json', 'Required: read ProjectDef JSON from stdin; print the saved definition as JSON')
+        .action(async (opts) => {
+        if (!opts.json) {
+            console.error(chalk.red('projects save requires --json (pipe one complete ProjectDef JSON object on stdin).'));
+            process.exit(1);
+        }
+        const chunks = [];
+        for await (const c of process.stdin)
+            chunks.push(c);
+        const raw = Buffer.concat(chunks).toString('utf8').trim();
+        if (!raw) {
+            console.error(chalk.red('projects save --json: empty stdin (expected one ProjectDef JSON object).'));
+            process.exit(1);
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch (e) {
+            console.error(chalk.red(`projects save --json: invalid JSON: ${e instanceof Error ? e.message : String(e)}`));
+            process.exit(1);
+        }
+        let def;
+        try {
+            def = validateProjectDef(parsed);
+        }
+        catch (e) {
+            console.error(chalk.red(e instanceof Error ? e.message : String(e)));
+            process.exit(1);
+        }
+        writeProjectDef(def);
+        const saved = loadProjectDef(def.name);
+        if (!saved) {
+            console.error(chalk.red(`projects save: wrote "${def.name}" but could not reload it`));
+            process.exit(1);
+        }
+        console.log(JSON.stringify(saved, null, 2));
+    });
     // ---- rm ----
     projects
         .command('rm <name>')
         .alias('remove')
         .description('Delete a project definition. Never touches the repo.')
-        .action((name) => {
+        .option('--json', 'Machine-readable success / error')
+        .action((name, opts) => {
+        if (!isSafeProjectName(name)) {
+            if (opts.json) {
+                console.log(JSON.stringify({ ok: false, name, error: `Invalid project name: "${name}"` }));
+            }
+            else {
+                console.error(chalk.red(`Invalid project name: "${name}"`));
+            }
+            process.exit(1);
+        }
         if (removeProjectDef(name)) {
-            console.log(chalk.green(`Removed project "${name}"`));
+            if (opts.json) {
+                console.log(JSON.stringify({ ok: true, name, removed: true }));
+            }
+            else {
+                console.log(chalk.green(`Removed project "${name}"`));
+            }
         }
         else {
-            console.error(chalk.red(`No project named "${name}".`));
+            if (opts.json) {
+                console.log(JSON.stringify({ ok: false, name, error: `No project named "${name}"` }));
+            }
+            else {
+                console.error(chalk.red(`No project named "${name}".`));
+            }
             process.exit(1);
         }
     });

package/dist/commands/resume.d.ts

@@ -0,0 +1,17 @@
+import type { Command } from 'commander';
+interface ResumeOptions {
+    mode?: string;
+    interactive?: boolean;
+    headless?: boolean;
+    cwd?: string;
+    quiet?: boolean;
+}
+/** Translate `agents resume <id>` to the canonical `agents run` surface after
+ * resolving the source identity. The run command remains the only executor. */
+export declare function buildResumeRunArgs(session: {
+    id: string;
+    agent: string;
+    version?: string;
+}, prompt: string | undefined, options: ResumeOptions): string[];
+export declare function registerResumeCommand(program: Command): void;
+export {};

package/dist/commands/resume.js

@@ -0,0 +1,80 @@
+/** Strict session resume convenience command. */
+import { spawn } from 'child_process';
+import chalk from 'chalk';
+import { setHelpSections } from '../lib/help.js';
+import { resolveSessionMetadataValue } from './sessions.js';
+/** Translate `agents resume <id>` to the canonical `agents run` surface after
+ * resolving the source identity. The run command remains the only executor. */
+export function buildResumeRunArgs(session, prompt, options) {
+    const spec = session.version ? `${session.agent}@${session.version}` : session.agent;
+    const args = ['run', spec, ...(prompt === undefined ? [] : [prompt]), '--resume', session.id];
+    if (options.mode)
+        args.push('--mode', options.mode);
+    if (options.interactive)
+        args.push('--interactive');
+    if (options.headless)
+        args.push('--headless');
+    if (options.cwd)
+        args.push('--cwd', options.cwd);
+    if (options.quiet)
+        args.push('--quiet');
+    return args;
+}
+export function registerResumeCommand(program) {
+    const cmd = program
+        .command('resume <session-id> [prompt]')
+        .description('Resume a session with its original harness, version, device, account, cwd, and mode')
+        .option('-m, --mode <mode>', 'Override the recorded launch mode')
+        .option('-i, --interactive', 'Resume interactively even when a prompt is provided')
+        .option('--headless', 'Resume headlessly (a prompt is required)')
+        .option('--cwd <path>', 'Override the recorded working directory')
+        .option('-q, --quiet', 'Suppress routing banners')
+        .action(async (sessionId, prompt, options) => {
+        const outcome = await resolveSessionMetadataValue(sessionId.trim());
+        if (outcome.kind === 'partial') {
+            console.error(chalk.red(`Could not resolve session while these devices were unavailable: ${outcome.failedPeers.join(', ')}`));
+            process.exitCode = 2;
+            return;
+        }
+        if (outcome.kind === 'not-found') {
+            console.error(chalk.red(`No session matching "${sessionId}".`));
+            process.exitCode = 1;
+            return;
+        }
+        if (outcome.kind === 'ambiguous') {
+            console.error(chalk.red(`"${sessionId}" matches ${outcome.candidates.length} sessions. Pass the full session id.`));
+            process.exitCode = 1;
+            return;
+        }
+        const args = buildResumeRunArgs(outcome.session, prompt, options);
+        const child = spawn(process.execPath, [process.argv[1], ...args], {
+            stdio: 'inherit',
+            env: {
+                ...process.env,
+                // Avoid repeating the fleet lookup in the delegated local `run`
+                // process. The value is metadata-only and is not forwarded over SSH;
+                // the owner performs its own local SQLite lookup.
+                AGENTS_RESUME_SOURCE_JSON: JSON.stringify(outcome.session),
+            },
+        });
+        const exitCode = await new Promise((resolve) => {
+            child.once('error', () => resolve(127));
+            child.once('exit', (code, signal) => resolve(code ?? (signal ? 1 : 0)));
+        });
+        process.exitCode = exitCode;
+    });
+    setHelpSections(cmd, {
+        examples: `
+      # Resume by full id
+      agents resume 019fd0c8-b3e9-77a2-a1a4-444698c4d897
+
+      # Resume and continue headlessly
+      agents resume 019fd0c8-b3e9-77a2-a1a4-444698c4d897 "finish the tests"
+
+      # Deliberately change permissions
+      agents resume 019fd0c8-b3e9-77a2-a1a4-444698c4d897 --mode edit`,
+        notes: `
+      Full IDs resolve from the local session database first; an SSH fleet lookup runs only after a local miss.
+      Use agents run auto --resume <id> when the original account is unavailable and another harness may continue.`,
+    });
+}

package/dist/commands/routines.js

@@ -14,7 +14,7 @@ import { isDaemonRunning, signalDaemonReload, startDaemon, stopDaemon, readDaemo
 import { assertSchedulerEnabled } from '../lib/device-config.js';
 import { resolveAgentName, isAgentHardDeprecated, hardDeprecationError } from '../lib/agents.js';
 import { humanizeCron, humanizeNextRun, formatRepoLink, REPO_DISPLAY_MAX } from '../lib/routines-format.js';
-import { listJobs as listAllJobs, deleteJob, readJob, validateJob, writeJob, setJobEnabled, listRuns, routineStats, getLatestRun, getRunDir, getJobPath, parseAtTime, hasCompletedOneShotRun, isOneShotLikeSchedule, isOneShotRoutine, isPastOneShotRoutine, jobRunsOnThisDevice, checkJobDeviceEligibility, normalizeTriggerEvent, parseHostStrategy, resolveHostStrategy, placementRequiresFiringPin, HOST_STRATEGIES, } from '../lib/routines.js';
+import { listJobs as listAllJobs, deleteJob, readJob, validateJob, writeJob, setJobEnabled, listRuns, routineStats, getLatestRun, getRunDir, getJobPath, parseAtTime, hasCompletedOneShotRun, isOneShotLikeSchedule, isOneShotRoutine, isPastOneShotRoutine, jobRunsOnThisDevice, checkJobDeviceEligibility, normalizeTriggerEvent, parseHostStrategy, resolveHostStrategy, HOST_STRATEGIES, } from '../lib/routines.js';
 import { discoverProjectRoutinesAt, enableProjectRoutines, disableProjectRoutines, syncProjectRoutines, syncAllProjectRoutines, listEnabledProjectRoots, resolveProjectRoot, displayProjectPath, listProjectRoutineFiles, } from '../lib/routines-project.js';
 import { fireWebhookJobs, matchJobsToWebhook } from '../lib/triggers/webhook.js';
 import { getRoutinesDir } from '../lib/state.js';
@@ -29,6 +29,9 @@ import { setHelpSections } from '../lib/help.js';
 import { loadDevices, loadDevicesSync } from '../lib/devices/registry.js';
 import { machineId, normalizeHost } from '../lib/machine-id.js';
 import { addHostOption } from '../lib/hosts/option.js';
+import { devicesWithRoutineEnabled } from '../lib/routine-activation.js';
+import { spawnSync } from 'node:child_process';
+import { getCliLaunch } from '../lib/cli-entry.js';
 /**
  * Human-friendly wall-clock a run took (e.g. "  · 3 min", "  · 45 sec"), or ""
  * when it hasn't completed or timestamps are unparseable. Leading separator lets
@@ -131,7 +134,7 @@ function placementTag(job) {
     return '->cloud';
 }
 function deviceLabel(job, width) {
-    const full = [job.devices?.join(',') ?? '', placementTag(job)]
+    const full = [devicesWithRoutineEnabled(job.name).join(','), placementTag(job)]
         .filter(Boolean)
         .join(' ');
     const raw = full.length === 0 ? 'all' : full;
@@ -182,9 +185,9 @@ export function groupRoutineJobsByDevice(jobs, registry, self = machineId()) {
             add(`host:${normalizeHost(host)}`, titleWithDeviceState(`Host: ${host}`, host, registry), job);
             continue;
         }
-        const devices = job.devices ?? [];
+        const devices = devicesWithRoutineEnabled(job.name);
         if (devices.length === 0) {
-            add('fleet', 'Fleet-wide', job);
+            add('disabled', 'Disabled', job);
             continue;
         }
         for (const device of devices) {
@@ -202,12 +205,14 @@ export function groupRoutineJobsByDevice(jobs, registry, self = machineId()) {
             return 0;
         if (group.key === 'fleet')
             return 1;
-        if (group.key === 'cloud')
+        if (group.key === 'disabled')
             return 2;
-        if (group.key.startsWith('device:'))
+        if (group.key === 'cloud')
             return 3;
-        if (group.key.startsWith('host:'))
+        if (group.key.startsWith('device:'))
             return 4;
+        if (group.key.startsWith('host:'))
+            return 5;
         return 5;
     };
     return [...groups.values()].sort((a, b) => order(a) - order(b) || a.title.localeCompare(b.title));
@@ -545,6 +550,7 @@ export function registerRoutinesCommands(program) {
             const nowJson = new Date();
             const payload = jobs.map((job) => {
                 const latestRun = localLatestRun(job);
+                const enabledDevices = devicesWithRoutineEnabled(job.name);
                 return {
                     name: job.name,
                     agent: job.agent ?? null,
@@ -555,7 +561,8 @@ export function registerRoutinesCommands(program) {
                     scheduleHuman: fireConditionLabel(job),
                     trigger: job.trigger ?? null,
                     timezone: job.timezone ?? null,
-                    devices: job.devices ?? [],
+                    devices: enabledDevices,
+                    enabledDevices,
                     host: job.host ?? null,
                     hostStrategy: resolveHostStrategy(job),
                     source: job.source ?? null,
@@ -628,7 +635,7 @@ export function registerRoutinesCommands(program) {
         .option('-t, --timeout <timeout>', 'Kill the agent if it runs longer than this (e.g., 10m, 2h, 3d, 1w; max 1w)', '10m')
         .option('--timezone <tz>', 'Interpret schedule in this timezone (e.g., America/Los_Angeles)')
         .option('--devices <names>', 'Fleet allowlist (comma-separated): only listed devices schedule and fire this routine. Omit for unrestricted.')
-        .option('--run-on <name>', 'BODY placement: execute the job body on this machine over SSH (registered host, device, capability tag, or user@host). Sets hostStrategy=host. Not eligibility — see --devices. Auto-pins devices to THIS machine unless --devices is given. Same model as agents run --where device:<name> (docs/00-concepts.md#placement).')
+        .option('--run-on <name>', 'BODY placement: execute the job body on this machine over SSH (registered host, device, capability tag, or user@host). Sets hostStrategy=host. Same model as agents run --where device:<name> (docs/00-concepts.md#placement).')
         .option('--placement <strategy>', `BODY placement strategy: ${HOST_STRATEGIES.join('|')} (default: local, or host when --run-on is set). Maps to the shared Placement model (local|device|fleet|cloud). Not the same as --host (which manages routines on a remote machine).`)
         .option('--run-cwd <dir>', 'Working directory on the --run-on host (--remote-cwd is taken by the remote-management passthrough)')
         .option('--at <time>', 'One-shot mode: run once at this time (e.g., "14:30" or "2026-02-24 09:00"), then disable')
@@ -727,15 +734,6 @@ export function registerRoutinesCommands(program) {
                 console.error(chalk.red('--placement host requires --run-on <name>'));
                 process.exit(1);
             }
-            // Off-box placement without a --devices pin would fire on EVERY daemon
-            // in the fleet, each dispatching once — duplicate runs (RUSH-1980).
-            // Pin to this machine unless the user chose an explicit eligibility set.
-            const strategyForPin = hostStrategy
-                ?? (options.runOn ? 'host' : 'local');
-            if (placementRequiresFiringPin(strategyForPin) && !devices) {
-                devices = [machineId()];
-                console.error(chalk.gray(`--placement ${strategyForPin} with no --devices: pinned firing to this machine (${devices[0]}).`));
-            }
             const config = {
                 name: nameOrPath,
                 ...(schedule ? { schedule } : {}),
@@ -767,6 +765,7 @@ export function registerRoutinesCommands(program) {
                 process.exit(1);
             }
             writeJob(config);
+            setJobEnabled(config.name, config.enabled && (!devices || devices.map(normalizeHost).includes(normalizeHost(machineId()))));
             if (options.json) {
                 writeJson({
                     ok: true,
@@ -831,14 +830,8 @@ export function registerRoutinesCommands(program) {
                 config.runOnce = true;
                 console.error(chalk.yellow(`Schedule "${config.schedule}" pins minute, hour, day, and month; treating it as one-shot. Prefer --at for one-time routines.`));
             }
-            // Same duplicate-fire guard as --placement/--run-on: off-box placement
-            // with no eligibility pin would fire from every daemon in the fleet.
-            const fileStrategy = resolveHostStrategy(config);
-            if (placementRequiresFiringPin(fileStrategy) && (!config.devices || config.devices.length === 0)) {
-                config.devices = [machineId()];
-                console.error(chalk.gray(`${fileStrategy} placement with no devices pin: pinned firing to this machine (${config.devices[0]}).`));
-            }
             writeJob(config);
+            setJobEnabled(config.name, config.enabled && (!config.devices || config.devices.map(normalizeHost).includes(normalizeHost(machineId()))));
             if (options.json) {
                 writeJson({
                     ok: true,
@@ -1435,12 +1428,13 @@ export function registerRoutinesCommands(program) {
             process.exit(1);
         }
     });
-    // Fleet allowlist management for a single routine.
+    // Device activation management for a single routine. Each mutation executes
+    // on the target device so only that host writes devices/<hostname>/agents.yaml.
     routinesCmd
         .command('devices [name]')
-        .description('View or change which devices may run a routine. Without flags, opens an interactive picker (requires a TTY).')
-        .option('--set <devices>', 'Replace the allowlist with this comma-separated list (strict fleet validation)')
-        .option('--clear', 'Remove the allowlist so the routine runs on every device')
+        .description('View or change the devices where a routine is enabled. Without flags, opens an interactive picker (requires a TTY).')
+        .option('--set <devices>', 'Replace the enabled-device set with this comma-separated list')
+        .option('--clear', 'Disable the routine on every registered device')
         .action(async (name, options) => {
         const hasSet = options.set !== undefined;
         if (hasSet && options.clear) {
@@ -1457,33 +1451,37 @@ export function registerRoutinesCommands(program) {
             console.log(chalk.red(`Job '${name}' not found`));
             process.exit(1);
         }
+        const applyDevices = async (selected) => {
+            const registry = await loadDevices();
+            const registered = Object.keys(registry).map(normalizeHost);
+            const all = [...new Set([...registered, machineId()].map(normalizeHost))].sort();
+            const selectedSet = new Set(selected.map(normalizeHost));
+            const unknown = [...selectedSet].filter((device) => !all.includes(device));
+            if (unknown.length > 0)
+                throw new Error(`Unknown device${unknown.length === 1 ? '' : 's'}: ${unknown.join(', ')}`);
+            for (const device of all) {
+                const action = selectedSet.has(device) ? 'resume' : 'pause';
+                if (device === normalizeHost(machineId())) {
+                    setJobEnabled(name, action === 'resume');
+                    if (isDaemonRunning())
+                        signalDaemonReload();
+                    continue;
+                }
+                const launch = getCliLaunch(['routines', action, name, '--host', device]);
+                const result = spawnSync(launch.command, launch.args, { stdio: 'inherit', env: process.env });
+                if ((result.status ?? 1) !== 0)
+                    throw new Error(`Could not ${action} '${name}' on ${device}`);
+            }
+            console.log(chalk.green(selected.length === 0
+                ? `Routine '${name}' disabled on every registered device`
+                : `Routine '${name}' enabled on: ${selected.join(', ')}`));
+        };
         if (options.clear) {
-            const strategy = resolveHostStrategy(job);
-            if (placementRequiresFiringPin(strategy)) {
-                console.error(chalk.red(`Cannot clear devices for hostStrategy: ${strategy} — without a pin every fleet daemon would dispatch once.`));
-                console.error(chalk.gray(`Keep a single-machine pin (e.g. --set ${machineId()}) or switch to --placement local.`));
-                process.exit(1);
-            }
-            job.devices = undefined;
-            writeJob(job);
-            console.log(chalk.green(`Devices cleared for '${name}' — runs on all devices`));
-            if (isDaemonRunning())
-                signalDaemonReload();
+            await applyDevices([]);
             return;
         }
         if (hasSet) {
-            const devices = await parseAndValidateDevices(options.set);
-            job.devices = devices;
-            // Re-validate so host/fleet/cloud can't be left with an empty set via --set ""
-            const errs = validateJob(job);
-            if (errs.length > 0) {
-                console.error(chalk.red(errs.join('\n')));
-                process.exit(1);
-            }
-            writeJob(job);
-            console.log(chalk.green(`Devices for '${name}' set to: ${devices.join(', ')}`));
-            if (isDaemonRunning())
-                signalDaemonReload();
+            await applyDevices(await parseAndValidateDevices(options.set));
             return;
         }
         // Interactive picker
@@ -1496,34 +1494,18 @@ export function registerRoutinesCommands(program) {
             console.log(chalk.yellow('No devices registered. Enroll with: agents devices sync'));
             return;
         }
-        const currentSet = new Set((job.devices ?? []).map((d) => normalizeHost(d)));
+        const currentSet = new Set(devicesWithRoutineEnabled(name).map(normalizeHost));
         try {
             const { checkbox } = await import('@inquirer/prompts');
             const selected = await checkbox({
-                message: `Devices allowed to run '${name}' (space to toggle, enter to confirm, empty = unrestricted):`,
+                message: `Devices where '${name}' is enabled (space to toggle, enter to confirm):`,
                 choices: registeredNames.map((d) => ({
                     value: d,
                     name: d,
                     checked: currentSet.has(d),
                 })),
             });
-            if (selected.length === 0) {
-                const strategy = resolveHostStrategy(job);
-                if (placementRequiresFiringPin(strategy)) {
-                    console.error(chalk.red(`Cannot clear devices for hostStrategy: ${strategy} — without a pin every fleet daemon would dispatch once.`));
-                    return;
-                }
-                job.devices = undefined;
-                writeJob(job);
-                console.log(chalk.green(`Devices cleared for '${name}' — runs on all devices`));
-            }
-            else {
-                job.devices = selected;
-                writeJob(job);
-                console.log(chalk.green(`Devices for '${name}' set to: ${selected.join(', ')}`));
-            }
-            if (isDaemonRunning())
-                signalDaemonReload();
+            await applyDevices(selected);
         }
         catch (err) {
             if (isPromptCancelled(err)) {

package/dist/commands/sessions.d.ts

@@ -281,8 +281,8 @@ export declare function mergeLocalFirst(sessions: SessionMeta[], localMachine: s
  */
 export declare function serializeSessionsJson(sessions: SessionMeta[]): string;
 /** The intentionally small metadata contract emitted by `sessions --resolve`.
- * Transcript locations, extracted plans, account data, costs, and other indexed
- * payload stay local to the machine that owns them. */
+ * It includes only launch identity needed to route/resume. Transcript paths,
+ * extracted plans, costs, and content stay on the machine that owns them. */
 export declare function serializeResolvedSessionsJson(sessions: SessionMeta[]): string;
 /**
  * Whether the local machine's sessions belong in an `--active` view. Local is
@@ -636,12 +636,21 @@ export declare function fleetCandidatesByQuery(rows: SessionMeta[], query: strin
 export declare function metadataResolveForwardedArgs(selector: string, scope: Pick<SessionFilterOptions, 'agent' | 'project'>): string[];
 /** Build the local-only peer argv for a distributed tool search. */
 export declare function toolSearchForwardedArgs(argv: string[], hosts: string[]): string[];
-/** Resolution must fail closed when any selected peer did not answer. Choosing
- * from a partial fleet can turn an unseen candidate into a false unique match. */
+/** Resolution fails closed for prefixes/keywords when a peer did not answer.
+ * A full UUID is globally unique, so one exact hit is sufficient even when an
+ * unrelated registered device is offline. */
 export declare function metadataResolveOutcome(localMatches: SessionMeta[], remote: {
     sessions: SessionMeta[];
     unreachable: string[];
 }, selector: string): MetadataResolveOutcome;
+/** Reusable local-first resolver for `agents run --resume` and `agents resume`.
+ * Full UUIDs hit the local SQLite index without any SSH fan-out. */
+export declare function resolveSessionMetadataValue(selector: string, scope?: {
+    agent?: string;
+    project?: string;
+    local?: boolean;
+    hosts?: string[];
+}, deps?: Pick<FleetResolveDeps, 'gatherRemoteList'>): Promise<MetadataResolveOutcome>;
 /**
  * Locate a full session id or short id prefix across the online fleet and render it from the machine
  * that holds it. The local disk already missed; this fans `sessions <id> --json